Eric Finkel thought he’d dodged a bullet on a recent visit to Vietnam. His hotel “accidentally” charged his credit card $1,500 instead of the correct amount of $66. The staff immediately cancelled the erroneous charge right in front of him.
Problem solved, right? Wrong.
Months later, Finkel discovered the hotel had quietly resubmitted the fraudulent $1,500 charge without the cancellation slip. What followed was a lengthy ordeal with his credit card company that was only resolved because Finkel had kept his paper receipts. Without that documentation, his credit card company told him he’d be stuck paying for the scam.
“I can’t imagine how many travelers have been defrauded using this technique,” says Finkel, an executive based in Vancouver, Canada.
I handle credit card fraud cases almost daily as a consumer advocate. Plus, I can tell you, travelers are constantly in the crosshairs. Credit card fraud cases were on track to double last year, according to the Federal Trade Commission. Global losses hit $32 billion the previous year.
The old credit card fraud tricks still work
Some types of fraud never go out of style. The bad guys just find new venues. ATMs remain one of the most persistent threats for credit cards, especially for those going abroad.
Vlad Polyanskiy, chief marketing officer at FlightRefunder, saw it himself when a client’s card was skimmed at an ATM in Prague. “Four transactions for small amounts appeared on his account,” Polyanskiy says. “He found out thanks to SMS notifications.”
The client immediately blocked the card and contacted his bank. His bank returned the money two weeks later. But those were two weeks of uncertainty during what should have been a relaxing vacation.
Robert Hareland, a former U.S. consular officer, had his own ATM nightmare recently. His card was skimmed at a gas station on his way to catch a flight to Hawaii. “I only discovered what happened when my card stopped working in Hawaii,” he says.
The sophistication of skimming operations has evolved dramatically.
Modern skimmers can be nearly invisible, often placed over legitimate card readers at ATMs, gas stations, and even restaurant payment terminals. Some use Bluetooth technology to wirelessly transmit stolen data to criminals lurking nearby.
Peter Murphy experienced this during a recent visit to Europe. His business credit card was declined at a hotel in Berlin. When he checked his app, he found a series of $1 to $3 test charges in Brazil.
“All of the charges were indications of skimming,” says Murphy, the CEO of a sports equipment business and a frequent traveler. The fraud team at his bank stopped more than 20 attempted transactions in less than two hours.
These small test charges are a telltale sign of card skimming. Criminals use them to verify that stolen card data works before attempting larger purchases. By the time you notice a $2 charge from halfway around the world, your card details might already be for sale on the dark web.
Steve Payerle, president of Next Level Technologies, a cybersecurity firm, has tracked fraud patterns for over a decade.
“Credit card fraud spikes 40 percent during peak travel seasons,” he says. “The biggest mistake travelers make is using the same card for everything — creating a single point of failure.”
When businesses make “mistakes”
Not all credit card problems come from criminals. Sometimes, the businesses you’re trying to support are the problem.
Finkel’s Vietnam hotel incident illustrates a particularly insidious form of fraud that exploits the trust between travelers and legitimate businesses. The hotel had made an innocent-looking exchange rate error, confusing dollars for Vietnamese dong. The staff then created a paper trail that looked legitimate — they even performed the “cancellation” in front of witnesses. But months later, when memories fade, and receipts get lost, they resubmit the original charge without the corresponding cancellation.
“The situation was only resolved because I dug through a pile of papers from the trip and discovered the paper receipts,” Finkel says. “Without that documentation, the credit card company told us that we would have been stuck paying for the scam.”
The burden of proof in credit card disputes falls on cardholders
The burden of proof in credit card disputes often falls heavily on cardholders, especially for international transactions. Credit card companies have limited ability to investigate claims in foreign countries, and they often rely on merchant statements and documentation to resolve disputes.
Idil Kuyucu, a payment systems consultant and former Visa Europe contractor, experienced merchant fraud firsthand in Taormina, Sicily. During dinner at a restaurant, her card was mischarged twice — unauthorized transactions of €150 and €400 at the same point-of-sale terminal.
“I noticed it within minutes thanks to real-time SMS and app alerts,” Kuyucu says. She immediately locked the card in her banking app, called the issuer’s international number, and switched to her backup card. At the restaurant, she showed the SMS alerts and demanded cancellation receipts for both fraudulent transactions.
The charges were reversed within 10 business days, but Kuyucu’s quick action and documentation were important. “Without the real-time SMS and app alerts, the charges could easily have gone unnoticed and become much harder to unwind,” she says.
Airlines and hotels aren’t immune to “accidental” double-billing either. System glitches, processing errors, and sometimes outright fraud can result in duplicate charges that might not show up for weeks, when you’re already home and back to your routine. Disputing a $300 hotel charge from three weeks ago becomes a time-consuming headache.
Digital traps are everywhere
The rise of online travel booking has created new vulnerabilities that didn’t exist in the era of travel agents and paper tickets. Every website, app, and digital platform that stores your card information becomes a potential entry point for criminals.
The problem isn’t just with the big, well-known booking sites. Fraudsters have become increasingly sophisticated at creating fake travel websites that look legitimate but exist solely to steal credit card information. These sites often pop up around major events or travel seasons, offering deals that seem too good to be true.
Public Wi-Fi is a problem
Public Wi-Fi networks at airports, hotels, and cafés present another significant threat. Rafay Baloch, CEO of cybersecurity firm REDSECLABS, warns that these networks are “essentially open highways for cybercriminals.”
“The most overlooked vulnerability is using public Wi-Fi for travel bookings,” says Payerle. He has seen countless clients fall victim to this scenario. His firm has tracked a 78 percent reduction in travel-related breaches when clients use their phone’s hotspot instead of public Wi-Fi for financial transactions.
The rise of mobile banking has made travelers more vulnerable in some ways. While apps offer convenience and real-time monitoring, they also mean people are more likely to check their accounts and make transactions while connected to unsecured networks.
Of course, credit card scams based on your physical card aren’t the only challenge travelers face. Dave Lewis, the chief information security officer at 1Password, notes that mobile theft claims spike up to 20 percent during the summer months as people take phones on vacation. They become targets for theft. When your phone contains your banking apps, losing the device can mean losing control of your financial accounts.
READ ALSO:
If you pay for extra-legroom seats, what do you get? It depends on the airline
Do you stand up or stay seated when the plane arrives at the gate?
Christopher Elliott is the founder of Elliott Advocacy, a 501(c)(3) nonprofit organization that empowers consumers to solve their problems and helps those who can’t. He’s the author of numerous books on consumer advocacy and writes three nationally syndicated columns. He also publishes the Elliott Report, a news site for consumers, and Elliott Confidential, a critically acclaimed newsletter about customer service. If you have a consumer problem you can’t solve, contact him directly through his advocacy website. You can also follow him on X, Facebook, and LinkedIn, or sign up for his daily newsletter.
